Hi Andrezej, >The spreading infection of MyDoom made me change my filter. The idea is >the following: there is absolutely no point in bouncing the >infected mails >nowadays because contemporary worms - like MyDoom - notoriously forge >sender address. Therefore my /etc/mail/mimedefang-filter (starting from >line ~220) looks like this - see below. No bouncing, no >quarantines, just action_discard. For ALL the viruses/worms. That's it!
That's why I love Kaspersky AV: it uses a naming scheme where the virus name for all the email worms start with "I-Worm.", so I can discard the automatically generated junk and still notify the recipient for the few cases where they've received a word doc with macro virus or similar stuff. It's a real pitty that most other AV vendors don't return any information that allows you to categorize the detected virus. Bye, Martin _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
